CVE-2022-3089

Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-037-01	Broken Link

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:echelon:i.lon_vision:2.2:*:*:*:*:*:*:*

cpe:2.3:h:echelon:smartserver:2.2:*:*:*:*:*:*:*

History

25 Feb 2023, 03:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-02-13 17:15

Updated : 2024-02-04 23:14

NVD link : CVE-2022-3089

Mitre link : CVE-2022-3089

CVE.ORG link : CVE-2022-3089

JSON object : View

Products Affected

echelon

i.lon_vision
smartserver

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2022-3089", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 0.8}]}, "published": "2023-02-13T17:15:10.763", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-037-01", "tags": ["Broken Link"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "\n\n\n\n\nEchelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server. \n\n \n\n"}], "lastModified": "2023-11-07T03:50:46.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:echelon:i.lon_vision:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50970A8A-CC8A-49DA-96EB-18C2E92E4420"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:echelon:smartserver:2.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1685E1B3-A7F7-4E0F-9BFB-C0CC09739D2B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}